vidar | e9c16d954e11dae123f981ec7477975abbca8fcbbdbf0a4104eb79ead96ad8c1

Analysis

max time kernel
149s
max time network
152s
platform
windows10_x64
resource
win10-en-20210920
submitted
22/09/2021, 18:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b44325a20f1f6455822db78851ea62e0.exe
Size 1.5MB
Sample210922-wr5neadde7
SHA256 e9c16d954e11dae123f981ec7477975abbca8fcbbdbf0a4104eb79ead96ad8c1
MD5 b44325a20f1f6455822db78851ea62e0
SHA1 c0188c5e307595d01fc5fe2e59dc3bec1050c494
SHA512 b6a5eb982bd7006bbf47a3a71dd3e0e04b8203cc93f39d330df7f38fb3c30bfa88c4415b3c8856c18fe606e7e83b0aea0475aaabea0f914501babe5c7c44c27f
MD5 SHA1 SHA512

Score

10^/10

vidar 1013 spyware stealer

Malware Config

Extracted

Family

vidar

Version

40.9

Botnet

1013

https://stacenko668.tumblr.com/

Attributes

profile_id
1013

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 996 created 2056	996	WerFault.exe	69

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral2/memory/2056-116-0x0000000002A20000-0x0000000002B3B000-memory.dmp	family_vidar
behavioral2/memory/2056-117-0x0000000000400000-0x000000000057E000-memory.dmp	family_vidar

Downloads MZ/PE file

Loads dropped DLL 2 IoCs

pid	Process
2056	b44325a20f1f6455822db78851ea62e0.exe
2056	b44325a20f1f6455822db78851ea62e0.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Program crash 13 IoCs

pid	pid_target	Process	procid_target
2676	2056	WerFault.exe	69
2712	2056	WerFault.exe	69
3692	2056	WerFault.exe	69
2608	2056	WerFault.exe	69
3888	2056	WerFault.exe	69
1264	2056	WerFault.exe	69
812	2056	WerFault.exe	69
400	2056	WerFault.exe	69
3944	2056	WerFault.exe	69
960	2056	WerFault.exe	69
3500	2056	WerFault.exe	69
648	2056	WerFault.exe	69
996	2056	WerFault.exe	69

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	b44325a20f1f6455822db78851ea62e0.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	b44325a20f1f6455822db78851ea62e0.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2676	WerFault.exe
2676	WerFault.exe
2676	WerFault.exe
2676	WerFault.exe
2676	WerFault.exe
2676	WerFault.exe
2676	WerFault.exe
2676	WerFault.exe
2676	WerFault.exe
2676	WerFault.exe
2676	WerFault.exe
2676	WerFault.exe
2676	WerFault.exe
2676	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
2712	WerFault.exe
3692	WerFault.exe
3692	WerFault.exe
3692	WerFault.exe
3692	WerFault.exe
3692	WerFault.exe
3692	WerFault.exe
3692	WerFault.exe
3692	WerFault.exe
3692	WerFault.exe
3692	WerFault.exe
3692	WerFault.exe
3692	WerFault.exe
3692	WerFault.exe
3692	WerFault.exe
2608	WerFault.exe
2608	WerFault.exe
2608	WerFault.exe
2608	WerFault.exe
2608	WerFault.exe
2608	WerFault.exe
2608	WerFault.exe
2608	WerFault.exe
2608	WerFault.exe
2608	WerFault.exe
2608	WerFault.exe
2608	WerFault.exe
2608	WerFault.exe
2608	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe
3888	WerFault.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeRestorePrivilege	2676	WerFault.exe
Token: SeBackupPrivilege	2676	WerFault.exe
Token: SeDebugPrivilege	2676	WerFault.exe
Token: SeDebugPrivilege	2712	WerFault.exe
Token: SeDebugPrivilege	3692	WerFault.exe
Token: SeDebugPrivilege	2608	WerFault.exe
Token: SeDebugPrivilege	3888	WerFault.exe
Token: SeDebugPrivilege	1264	WerFault.exe
Token: SeDebugPrivilege	812	WerFault.exe
Token: SeDebugPrivilege	400	WerFault.exe
Token: SeDebugPrivilege	3944	WerFault.exe
Token: SeDebugPrivilege	960	WerFault.exe
Token: SeDebugPrivilege	3500	WerFault.exe
Token: SeDebugPrivilege	648	WerFault.exe
Token: SeDebugPrivilege	996	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\b44325a20f1f6455822db78851ea62e0.exe
"C:\Users\Admin\AppData\Local\Temp\b44325a20f1f6455822db78851ea62e0.exe"
1⤵
- Loads dropped DLL
- Modifies system certificate store
PID:2056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 956
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 1056
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 1068
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3692
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 1492
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 1712
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3888
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 1752
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:1264
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 1696
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 1732
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 1424
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3944
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 1728
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 1696
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:3500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 1744
  2⤵
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 1832
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious use of AdjustPrivilegeToken
  PID:996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2056-115-0x00000000006D0000-0x00000000006D1000-memory.dmp

Download

memory/2056-116-0x0000000002A20000-0x0000000002B3B000-memory.dmp

Download

memory/2056-117-0x0000000000400000-0x000000000057E000-memory.dmp

Download